From owner-freebsd-net@FreeBSD.ORG  Wed May 25 20:40:11 2011
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 73F68106566C
	for <freebsd-net@hub.freebsd.org>; Wed, 25 May 2011 20:40:11 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 64B268FC12
	for <freebsd-net@hub.freebsd.org>; Wed, 25 May 2011 20:40:11 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p4PKeBPZ082922
	for <freebsd-net@freefall.freebsd.org>; Wed, 25 May 2011 20:40:11 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p4PKeB6B082921;
	Wed, 25 May 2011 20:40:11 GMT (envelope-from gnats)
Date: Wed, 25 May 2011 20:40:11 GMT
Message-Id: <201105252040.p4PKeB6B082921@freefall.freebsd.org>
To: freebsd-net@FreeBSD.org
From: Joerg Wunsch <j@uriah.heep.sax.de>
Cc: 
Subject: Re: kern/157287: re0: INVARIANTS panic (Memory modified after free)
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Joerg Wunsch <j@uriah.heep.sax.de>
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 25 May 2011 20:40:11 -0000

The following reply was made to PR kern/157287; it has been noted by GNATS.

From: Joerg Wunsch <j@uriah.heep.sax.de>
To: FreeBSD-gnats-submit@freebsd.org, freebsd-bugs@FreeBSD.org
Cc:  
Subject: Re: kern/157287: re0: INVARIANTS panic (Memory modified after free)
Date: Wed, 25 May 2011 22:33:13 +0200

 Some more analysis on the stack trace:
 
 re_attach+0x118a corresponds to re_allocmem(), line 1085:
 
         /* Allocate DMA'able memory for the RX ring */
 
         error = bus_dmamem_alloc(sc->rl_ldata.rl_rx_list_tag,
             (void **)&sc->rl_ldata.rl_rx_list,
             BUS_DMA_WAITOK | BUS_DMA_COHERENT | BUS_DMA_ZERO,
             &sc->rl_ldata.rl_rx_list_map);
 
 callee bus_dmamem_alloc+0x8a is i386/i386/busdma_machdep.c,
 bus_dmamem_alloc() line 526:
 
         /* 
          * XXX:
          * (dmat->alignment < dmat->maxsize) is just a quick hack; the exact
          * alignment guarantees of malloc need to be nailed down, and the
          * code below should be rewritten to take that into account.
          *
          * In the meantime, we'll warn the user if malloc gets it wrong.
          */
         if ((dmat->maxsize <= PAGE_SIZE) &&
            (dmat->alignment < dmat->maxsize) &&
             dmat->lowaddr >= ptoa((vm_paddr_t)Maxmem)) {
                 *vaddr = malloc(dmat->maxsize, M_DEVBUF, mflags);
         } else {
 
 I could not spot anything obvious though.
 
 -- 
 cheers, J"org               .-.-.   --... ...--   -.. .  DL8DTL
 
 http://www.sax.de/~joerg/                        NIC: JW11-RIPE
 Never trust an operating system you don't have sources for. ;-)